Introduction
CoreDNS is a flexible and extensible DNS server that uses a plugin-based architecture. Instead of implementing all features in a single monolithic program, CoreDNS builds functionality through plugins. Each plugin performs a specific task during DNS query processing.
Plugins are configured in a configuration file called the Corefile. The order in which plugins appear in the Corefile determines how DNS requests are processed.
How CoreDNS Plugins Work
When a DNS query reaches CoreDNS, it is processed through a chain of plugins. Each plugin can:
Process the query
Modify the request or response
Return a response
Pass the query to the next plugin
The execution follows the top-to-bottom order defined in the Corefile.
Example configuration:
. {
log
errors
cache 30
forward . 8.8.8.8
}Processing flow:
log records the DNS query.
errors handles and logs errors.
cache checks if the response exists in cache.
forward forwards the query to upstream DNS servers if no cached entry is found.
Categories of CoreDNS Plugins
CoreDNS plugins are generally grouped based on their functionality.
3.1 Backend Plugins (Data Sources)
Backend plugins provide DNS records from different data sources.
Common backend plugins include:
kubernetes - Retrieves service and pod DNS records from Kubernetes.
file - Loads DNS records from zone files.
etcd - Retrieves DNS records stored in etcd.
hosts - Reads DNS entries from a hosts file.
Example:
file db.example.com
This loads DNS records from a zone file named db.example.com.
3.2 Forwarding Plugins
Forwarding plugins send DNS queries to external or upstream DNS servers.
Common forwarding plugin:
forward - Forwards DNS queries to specified upstream DNS servers.
Example:
forward . 8.8.8.8 1.1.1.1
This forwards queries to two upstream servers.
3.3 Cache Plugins
Caching plugins improve performance by storing previously resolved DNS responses.
Common caching plugin:
cache - Stores DNS responses for a specified time.
Example:
cache 30
This caches DNS responses for 30 seconds.
3.4 Observability and Logging Plugins
These plugins provide visibility into DNS operations and assist with debugging.
Common plugins include:
log - Logs DNS queries.
errors - Logs DNS errors.
prometheus - Exposes metrics for monitoring with Prometheus.
Example:
prometheus :9153
This exposes metrics on port 9153.
3.5 Load Balancing Plugins
These plugins help distribute DNS responses across multiple endpoints.
Common plugin:
loadbalance - Randomizes DNS response order for better traffic distribution.
3.6 Security Plugins
Security plugins help enforce access control and secure DNS responses.
Examples include:
acl - Implements access control lists.
dnssec - Enables DNS Security Extensions.
3.7 Request/Response Manipulation Plugins
These plugins modify DNS queries or responses dynamically.
Examples include:
rewrite - Rewrites DNS query names.
template - Generates DNS responses using templates.
Example:
rewrite name example.com internal.example.com
This rewrites incoming DNS queries to another domain.
4 Example CoreDNS Configuration
A typical configuration used in many Kubernetes clusters:
.:53 {
errors
health
kubernetes cluster.local
prometheus :9153
forward . /etc/resolv.conf
cache 30
loop
reload
}Explanation:
errors - Logs DNS errors.
health - Provides health check endpoint.
kubernetes - Enables Kubernetes service discovery.
prometheus - Exposes monitoring metrics.
forward - Sends external queries to upstream resolvers.
cache - Improves performance with caching.
loop - Prevents forwarding loops.
reload - Automatically reloads configuration changes.
5 Key Concept
The core design principle of CoreDNS is:
CoreDNS functionality is entirely built from plugins.
Benefits of this architecture:
Modular design
Easy extensibility
Flexible configuration
Efficient DNS query processing
Plugins can be added, removed, or reordered in the Corefile to customize the DNS server's behavior.
Default CoreDNS Plugins List
1. Request Processing / Control
acl - Access control lists for DNS queries
any - Handles ANY DNS queries
bind - Binds server to specific IP addresses
bufsize - Controls EDNS buffer size
header - Manipulates DNS headers
metadata - Adds metadata to DNS request context
2. Backend / Data Source Plugins
auto - Automatically loads zone files from a directory
file - Serves DNS zones from zone files
hosts - Serves records from a hosts file
kubernetes - Provides service discovery for Kubernetes
template - Generates dynamic DNS responses
3. Forwarding and Resolution
forward - Forwards DNS queries to upstream resolvers
grpc - Allows DNS resolution via gRPC
transfer - Handles DNS zone transfers
4. Performance and Load Handling
cache - Caches DNS responses
loadbalance - Randomizes record order for load balancing
5. Observability / Monitoring
errors - Logs DNS errors
log - Logs DNS queries
debug - Enables debugging logs
prometheus - Exposes metrics for monitoring systems
6. Health and Lifecycle Management
health - Provides a health check endpoint
ready - Indicates server readiness
reload - Automatically reloads Corefile changes
loop - Detects forwarding loops
7. DNS Manipulation Plugins
rewrite - Rewrites DNS queries or responses
dns64 - Enables DNS64 translation for IPv6 networks
chaos - Responds to CHAOS class queries
8. Miscellaneous Utilities
root - Sets the root directory for zone files
whoami - Returns client DNS request information
autopath - Optimizes DNS search path resolution